A method for establishing a group key based on a pre-shared secret

Abstract

The application relates to a group key establishment method based on pre-shared secrets, relates to the technical field of network security, and solves the problems of large calculation and communication overhead and many communication rounds in existing group key establishment schemes. The method comprises the following steps: a trusted center selects system parameters, the system parameters are system parameters of a communication system composed of a group including multiple nodes, wherein pre-shared keys exist between two nodes in the group; each node encrypts a temporary key of the node into adjacent nodes in the group according to the system parameters and the pre-shared keys; each node converts the temporary key of the adjacent nodes into broadcast ciphertext of the node according to the system parameters and the pre-shared keys; and each node verifies the broadcast ciphertext of all other nodes according to the system parameters, and generates a group key according to the system parameters and the broadcast ciphertext of all other nodes after verification.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method for establishing a group key based on a pre-shared secret. Background Technology

[0002] Decentralized self-organizing network technology enables the rapid construction of a mobile communication network at any time and any location without the support of existing information infrastructure, making it possible for terminals to achieve decentralized, free, and rapid communication.

[0003] The current decentralized self-organizing network scenario has the following four prominent characteristics:

[0004] 1. Decentralized: In ad hoc networks, nodes are peer-to-peer, with no traditional control center. Each legitimate node can initiate the group key establishment process, making it difficult to apply centralized solutions to establish efficient security authentication and key establishment mechanisms for ad hoc networks.

[0005] 2. Rapid Network Topology Changes: During operation, events such as new nodes joining the network and existing nodes leaving the network cause frequent changes in the ad hoc network topology. This characteristic requires ad hoc networks to strictly manage the identities of incoming and outgoing nodes, especially to be able to quickly change the group key when a node leaves the network.

[0006] 3. High demand for multi-node communication: In most cases, nodes need to exchange information in real time to ensure that the work is completed effectively. For example, when computing together, intermediate data needs to be shared with other nodes in real time, and when multiple nodes work together, information such as current status and location needs to be shared with other nodes in real time.

[0007] This requires ad hoc networks to have the ability to quickly establish group keys for communication. However, current group key establishment schemes suffer from high computational and communication overhead and a large number of communication rounds. Therefore, establishing an efficient and sustainable group key establishment scheme is an urgent problem to be solved. Summary of the Invention

[0008] Based on the above analysis, the embodiments of the present invention aim to provide a method for establishing a group key based on a pre-shared secret, in order to solve the problems of large computational and communication overhead and a large number of communication rounds in existing group key establishment schemes.

[0009] This invention provides a method for establishing a group key based on a pre-shared secret, comprising the following steps:

[0010] Step S100: The trusted center selects system parameters, which are system parameters of a communication system consisting of a group of multiple nodes, wherein there is a pre-shared key between each pair of nodes in the group;

[0011] Step S200: Each node encrypts its temporary key and sends it to its neighboring nodes in the group according to the system parameters and the pre-shared key;

[0012] Step S300: Each node converts the temporary key of its neighboring nodes into its own broadcast ciphertext based on the system parameters and the pre-shared key; and

[0013] Step S400: Each node verifies the broadcast ciphertext of all other nodes according to the system parameters, and after successful verification, generates a group key based on the system parameters and the broadcast ciphertext of all other nodes.

[0014] Based on a further improvement of the above method, the system parameters include a negotiation node election algorithm. Before executing step S200, the establishment method further includes the following steps:

[0015] Each node executes the negotiation node election algorithm to obtain n node groups and one node in each node group participating in key negotiation, where n is less than or equal to the number of nodes in the group;

[0016] Each node participating in key negotiation sorts all n nodes to obtain a list of nodes connected end to end; and the nodes in steps S200 to S400 refer to the nodes among the n nodes.

[0017] Based on a further improvement to the above method, after step S400, the method further includes obtaining a group key by performing the following steps on other nodes in each node group that did not participate in key negotiation:

[0018] Step S500: Each node participating in the key negotiation generates a shared secret value based on the broadcast ciphertext of the other nodes participating in the key negotiation;

[0019] Step S600: Each node participating in the key negotiation encrypts and sends the shared secret value to other nodes in its node group that did not participate in the key negotiation, based on the pre-shared key.

[0020] Step S700: Other nodes in the node group that did not participate in key negotiation generate a group key based on the system parameters and the shared secret value.

[0021] Based on a further improvement of the above method, step S300 includes:

[0022] Each node obtains the first message based on the difference between the temporary keys of two adjacent nodes;

[0023] Each node obtains the second message based on the system parameters and the first message;

[0024] The broadcast ciphertext includes the first message and the second message.

[0025] Based on a further improvement of the above method, step S400 includes:

[0026] Step 401: Each node verifies the second message of all nodes according to the system parameters. If the verification of the second message of any node fails, the execution is terminated; otherwise, step 402 is executed.

[0027] Step 402: Each node sums the first messages from all nodes. If the sum is equal to 0, the verification is successful; otherwise, execution is terminated.

[0028] Based on a further improvement of the above method, the system parameters include a symmetric encryption / decryption algorithm, a first hash function, a second hash function, a hash key, and an initial state value. The trusted center selection system parameters include selection system parameters.

[0029] Choose a symmetric encryption algorithm: And the corresponding symmetric decryption algorithm: Where {0,1} * A bit string of 0s and 1s of arbitrary length. This represents the value space of the symmetric encryption key;

[0030] Choose the first hash function

[0031] Choose the second hash function Where l is the output bit length of the second hash function. The value space of the key for the second hash function;

[0032] from Then select the hash key K for the group and distribute the hash key K to each node in the group;

[0033] from Then select the initial state value S0 of the group and distribute the initial state value S0 to each node in the group.

[0034] Based on a further improvement to the above method, the second message obtained by each node according to the system parameters and the first message includes:

[0035] Node i calculates the second message h according to the following formula. i :

[0036] h i =H2(K,ID) i ||x i )

[0037] Among them, IDi This represents the identity information of node i, where || represents the connector, and x i Let i be the first message of node i, where i∈{0,…,n-1} and n is the number of nodes.

[0038] Based on a further improvement to the above method, each node verifies the second message of all nodes according to the system parameters, including:

[0039] Node i verifies whether the following equation is true:

[0040] h j =H2(K,ID) j ||x j )

[0041] Among them, h j The second message for node j, ID j For the identity information of node j, x j Let be the first message of node j, where j∈{0,…,n-1}, n is the number of nodes and j≠i.

[0042] Based on a further improvement of the above method, step S500 includes:

[0043] Node i calculates the shared secret value gsk according to the following formula. i :

[0044] gsk i =(n-1)x i +(n-2)x i-1 +…+x i-n+2 -n(r i +r i+1 )

[0045] Where, x i x i-1 ... x i-n+2 For the first message of the corresponding sequence number node, r i and r i+1 Let be the temporary keys for the i-th node and the (i+1)-th node.

[0046] Based on a further improvement to the above method, each node generates a group key according to the system parameters and the broadcast ciphertext of all other nodes, including:

[0047] Node i calculates the group key wk according to the following formula. i :

[0048] wk i =H1(gsk i ,S0,ID0,x0,ID1,x1,…,ID n-1 ,xn-1 ).

[0049] Compared with the prior art, the present invention can achieve at least one of the following beneficial effects:

[0050] 1. This scheme constructs pairwise shared keys based on pre-shared secrets. Each user only needs symmetric encryption / decryption operations and random number addition / subtraction operations, resulting in high computational efficiency.

[0051] 2. In this scheme, each participating node only needs to send a symmetric encrypted ciphertext of a random number during the key establishment process, or only needs to send a random number and a hash value, resulting in low communication overhead.

[0052] 3. This scheme can ensure that all users generate the same session key.

[0053] In this invention, the above-described technical solutions can be combined with each other to achieve more preferred combinations. Other features and advantages of this invention will be set forth in the following description, and some advantages may become apparent from the description or be learned by practicing the invention. The objects and other advantages of this invention can be realized and obtained from what is particularly pointed out in the description and drawings. Attached Figure Description

[0054] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Throughout the drawings, the same reference numerals denote the same parts.

[0055] Figure 1 This is a flowchart illustrating a method for establishing a group key based on a pre-shared secret according to an embodiment of the present invention. Detailed Implementation

[0056] Preferred embodiments of the present invention will now be described in detail with reference to the accompanying drawings, which form part of this application and are used together with the embodiments of the present invention to illustrate the principles of the present invention, but are not intended to limit the scope of the present invention.

[0057] Figure 1 This is a flowchart illustrating a method for establishing a group key based on a pre-shared secret according to an embodiment of the present invention.

[0058] The following is combined with Figure 1 An embodiment of the present invention will be described.

[0059] like Figure 1 As shown, the method for establishing a group key based on a pre-shared secret includes:

[0060] Step S100: The trusted center selects system parameters. The system parameters are the system parameters of a communication system consisting of a group of multiple nodes, and there are pre-shared keys between each pair of nodes in the group.

[0061] In this embodiment, the Trusted Center can select system parameters based on an initialization algorithm. This initialization algorithm takes a certain security level as input and selects a set of system parameters.

[0062] In some embodiments, the initialization algorithm includes performing the following operations:

[0063] The algorithm takes the security level κ as input and performs the following operations:

[0064] 1. Choose a symmetric encryption algorithm: And the corresponding symmetric decryption algorithm: Where {0,1} * A bit string of 0s and 1s of arbitrary length. This represents the value space for the symmetric encryption key. The bit length is t. Enc(K,M) and Dec(K,C) represent encrypting the plaintext message M and decrypting the ciphertext message C using the symmetric key K, respectively. The value of the bit length t of the symmetric encryption key is determined according to the security level required by the specific task.

[0065] 2. Select the first hash function

[0066] 3. Choose the second hash function Where l is the output bit length of the second hash function. The value space of the key for the second hash function.

[0067] 4. From Then select the hash key K for the group and distribute the hash key K to each node in the group.

[0068] 5. From Then select the initial state value S0 of the group and distribute the initial state value S0 to each node in the group.

[0069] In some embodiments, the initialization algorithm further includes performing the following operations:

[0070] 6. Select a negotiation node election algorithm. This algorithm can take the identity information of all nodes in the current group (let's say there are m nodes) as input, divide all nodes in the group into n groups, and select one node from each group, finally obtaining n groups and n nodes (m≥n).

[0071] In the above embodiments, the symmetric encryption / decryption algorithm corresponding to security level κ, the first hash function, the second hash function, the hash key K, and the initial state value S0 are a set of system parameters.

[0072] It should be noted that this embodiment is beneficial when the group size is large and the information transmission between nodes is unstable, because it is difficult to guarantee that all nodes will participate in the negotiation process under such circumstances. Therefore, this embodiment limits the number of nodes participating in group key negotiation to an acceptable range.

[0073] In this embodiment, the specific implementation of the negotiation node election algorithm and the values ​​of m and n are determined according to specific application requirements and group size, and this embodiment does not impose any restrictions.

[0074] In any of the above embodiments, a pre-shared symmetric encryption key GK exists between every pair of nodes in the group. ij The symmetric encryption key GK ij For user ID i and user ID j A pre-shared key, where i,j∈{0,…,m-1}. A pre-shared symmetric encryption key GK. ij The existing algorithm for generating a shared key between the two parties can be followed, and will not be described in detail in this embodiment.

[0075] Step S200: Each node encrypts its own temporary key and sends it to its neighboring nodes in the group according to the system parameters and the pre-shared key.

[0076] In this embodiment, each node i in the group can perform the following operations:

[0077] 1. Sort m nodes according to a specific rule (such as by distance between nodes, or by the first letter of their identity names), resulting in a contiguous list of identities. Let this list be {ID0, ID1, ..., ID...} m-1}, where ID0 = ID m For node ID m-1 The next item, the node is ID. i (i∈{0,…,m-1}).

[0078] 2. Node i selects a temporary key r i .

[0079] 3. Node i obtains the pairwise shared key GK with its two neighboring nodes. i,i+1 GK i,i-1 .

[0080] 4. Node i encrypts and computes the temporary key C i,i+1 =Enc(GK i,i+1 ,ri ) and C i,i-1 =Enc(GK i,i-1 ,r i ).

[0081] 5. Send C i,i+1 Give ID i+1 Send C i,i-1 Give ID i-1 .

[0082] In the above embodiment, Enc() is the symmetric encryption algorithm in the system parameters.

[0083] In other embodiments, the nodes within the group can perform the following operations:

[0084] Phase 1:

[0085] 1. Execute the negotiation node election algorithm to obtain n groups and n nodes participating in key negotiation. Within each node group, one node participates in key negotiation. n is less than or equal to the number of nodes in the group.

[0086] Phase 2:

[0087] Each of the n nodes participating in key negotiation performs the following operation:

[0088] 1. Sort n nodes according to a specific rule (such as by distance between nodes, or by the first letter of their identities), resulting in a contiguous list of identities. Let this list be {ID0, ID1, ..., ID...} n-1}, where ID0 = ID n For node ID n-1 The next item, the node is ID. i (i∈{0,…,n-1}).

[0089] 2. Select temporary key r i .

[0090] 3. Obtain the pairwise shared key GK i,i+1 GK i,i-1 .

[0091] 4. Encrypted computation C i,i+1 =Enc(GK i,i+1 ,r i ) and C i,i-1 =Enc(GK i,i-1 ,r i ).

[0092] 5. Send C i,i+1 Give ID i+1 Send C i,i-1 Give ID i-1.

[0093] Step S300: Each node converts the temporary keys of its neighboring nodes into its own broadcast ciphertext based on the system parameters and the pre-shared key.

[0094] In this embodiment, each node obtains the C of its neighboring nodes. i+1,i and C i-1,i Then, the pre-shared key GK with neighboring nodes can be used. i,i+1 GK i,i-1 Decryption yields the temporary key r of the adjacent nodes. i+1 =Dec(GK i,i+1 C i+1,i ), r i-1 =Dec(GK i,i-1 C i-1,i ).

[0095] In this embodiment, each node can use a broadcast ciphertext generation algorithm to convert the temporary keys of neighboring nodes into broadcast ciphertext. The broadcast ciphertext generation algorithm takes the temporary keys of neighboring nodes and system parameters as input and outputs a broadcast ciphertext.

[0096] In some embodiments, the broadcast ciphertext generation algorithm includes the following steps:

[0097] Step 310: Each node obtains the first message based on the difference between the temporary keys of two adjacent nodes;

[0098] Step 320: Each node obtains the second message based on the system parameters and the first message.

[0099] Steps 310-320 will be explained below with reference to a specific embodiment.

[0100] Node ID i (i∈{0,…,m-1}) perform the following operation:

[0101] Calculate x i =r i+1 -r i-1 h i =H2(K,ID) i ||x i ), and (ID) i ,x i ,h i ) is sent as broadcast ciphertext to other node IDs j (j∈{0,…,m-1}andj≠i), where || represents the concatenation operator.

[0102] In the above embodiments, x i For node ID i First news, hi For node ID i The second message.

[0103] In this embodiment, all nodes in the group perform the above operation, so the domain of node i is {0,…,m-1}.

[0104] In other embodiments, steps 310-320 may include a node ID. i (i∈{0,…,n-1}) perform the following operation:

[0105] Calculate x i =r i+1 -r i-1 h i =H2(K,ID) i ||x i ), and (ID) i ,x i ,h i ) is sent as broadcast ciphertext to other node IDs j (j∈{0,…,n-1}andj≠i), where || represents the concatenation operator.

[0106] In this embodiment, only the nodes participating in key negotiation in the group perform the above operation, so the domain of node i is {0,…,n-1}.

[0107] Step S400: Each node verifies the broadcast ciphertext of all other nodes according to the system parameters, and after successful verification, generates a group key based on the system parameters and the broadcast ciphertext of all other nodes.

[0108] In this embodiment, each node can use a broadcast ciphertext verification algorithm to verify the broadcast ciphertext of other nodes. The broadcast ciphertext verification algorithm takes the broadcast ciphertext of other nodes and system parameters as input and outputs the verification result.

[0109] In some embodiments, the broadcast ciphertext verification algorithm includes the following steps:

[0110] Step 401: Each node verifies the second message of all nodes according to the system parameters. If the second message of any node fails to be verified, the execution is terminated; otherwise, proceed to step 402.

[0111] Step 402: Each node sums the first messages from all nodes. If the sum is equal to 0, the verification passes; otherwise, execution terminates.

[0112] Steps 401-402 will be explained below with reference to a specific embodiment.

[0113] Node ID i(i∈{0,…,m-1}) perform the following operation:

[0114] 1. Retrieve all (IDs) j ,x j ,h j After (j=0,…,m-1), verify h. j =H2(K,ID) j ||x j If any condition is not met, return and terminate execution.

[0115] 2. Determine whether the following conditions are met: x0 + x1 + ... + x m-1 =0, if not satisfied, return and terminate execution.

[0116] In the above embodiments, the hash function H2 and the hash key K are system parameters.

[0117] In other embodiments, steps 401-402 may include a node ID. i (i∈{0,…,n-1}) perform the following operation:

[0118] 1. Retrieve all (IDs) j ,x j ,h j After (j=0,…,n-1), verify h. j =H2(K,ID) j ||x j If any condition is not met, return and terminate execution.

[0119] 2. Determine whether the following conditions are met: x0 + x1 + ... + x n-1 =0, if not satisfied, return and terminate execution.

[0120] In the above embodiments, the hash function H2 and the hash key K are system parameters.

[0121] In this embodiment, each node can generate a group key using a group key generation algorithm. The group key generation algorithm takes the broadcast ciphertext of other nodes and system parameters as input and outputs a group key.

[0122] In some embodiments, the group key generation algorithm includes the following steps:

[0123] Node ID i (i∈{0,…,m-1}) perform the following operation:

[0124] 1. Calculate the shared secret value gsk i =(m-1)x i +(m-2)x i-1 +…+x i-m+2-m(r i +r i+1 ).

[0125] 2. Calculate the session key wk i =H1(gsk i ,S0,ID0,x0,ID1,x1,…,ID m-1 ,x m-1 Session key wk i This is the group key.

[0126] In this embodiment, all nodes in the group perform the above operation, so the domain of node i is {0,…,m-1}.

[0127] In other embodiments, the group key generation algorithm includes the following steps:

[0128] Node ID i (i∈{0,…,n-1}) perform the following operation:

[0129] 1. Calculate the shared secret value gsk i =(n-1)x i +(n-2)x i-1 +…+x i-n+2 -n(r i +r i+1 ).

[0130] 2. Calculate the session key wk i =H1(gsk i ,S0,U0,x0,U1,x1,…,U n-1 ,x n-1 Session key wk i This is the group key.

[0131] In this embodiment, only the nodes participating in key negotiation in the group perform the above operation, so the domain of node i is {0,…,n-1}.

[0132] In some embodiments, after obtaining the group keys of the n nodes participating in key negotiation, it is also necessary to obtain the group keys of the other nodes in each group that did not participate in key negotiation. Figure 1 The method in step S400 further includes, after step S400:

[0133] Step S500: Each node participating in the key negotiation generates a shared secret value based on the broadcast ciphertext of other nodes participating in the key negotiation.

[0134] Specifically, node ID i (i∈{0,…,n-1}) perform the following operation:

[0135] Calculate the shared secret value gski =(n-1)x i +(n-2)x i-1 +…+x i-n+2 -n(r i +r i+1 ).

[0136] Step S600: Each node participating in the key negotiation encrypts and sends the shared secret value to other nodes in its node group that did not participate in the key negotiation, based on the pre-shared key.

[0137] Step S700: Other nodes in the node group that did not participate in key negotiation generate a group key based on system parameters and shared secret value.

[0138] Specifically, other nodes within the node group can perform the following operations:

[0139] Calculate session key wk i =H1(gsk i ,S0,U0,x0,U1,x1,…,U n-1 ,x n-1 Session key wk i This is the group key.

[0140] The embodiments described above have at least the following beneficial technical effects:

[0141] 1. This scheme constructs pairwise shared keys based on pre-shared secrets. Each user only needs symmetric encryption / decryption operations and random number addition / subtraction operations, resulting in high computational efficiency.

[0142] 2. In this scheme, each participating node only needs to send a symmetric encrypted ciphertext of a random number during the key establishment process, or only needs to send a random number and a hash value, resulting in low communication overhead.

[0143] 3. This scheme can ensure that all users generate the same session key.

[0144] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for establishing a group key based on a pre-shared secret, characterized in that, Includes the following steps: Step S100: The trusted center selects system parameters, which are system parameters of a communication system consisting of a group of multiple nodes, wherein there is a pre-shared key between each pair of nodes in the group; Step S200: Each node encrypts its temporary key and sends it to its neighboring nodes in the group according to the system parameters and the pre-shared key; Step S300: Each node converts the temporary key of its neighboring nodes into its own broadcast ciphertext based on the system parameters and the pre-shared key; and Step S400: Each node verifies the broadcast ciphertext of all other nodes according to the system parameters, and after successful verification, generates a group key based on the system parameters and the broadcast ciphertext of all other nodes.

2. The method for establishing according to claim 1, characterized in that, The system parameters include a negotiation node election algorithm. Before executing step S200, the establishment method further includes the following steps: Each node in the group executes the negotiation node election algorithm to obtain n node groups and one node in each node group participating in key negotiation, where n is less than or equal to the number of nodes in the group; Each node participating in key negotiation sorts all n nodes to obtain a list of nodes connected end to end; Furthermore, the nodes in steps S200 to S400 refer to the nodes among the n nodes.

3. The method for establishing according to claim 2, characterized in that, Following step S400, the process also includes obtaining the group key by performing the following steps on other nodes in each node group that did not participate in key negotiation: Step S500: Each node participating in the key negotiation generates a shared secret value based on the broadcast ciphertext of the other nodes participating in the key negotiation; Step S600: Each node participating in the key negotiation encrypts and sends the shared secret value to other nodes in its node group that did not participate in the key negotiation, based on the pre-shared key. Step S700: Other nodes in the node group that did not participate in key negotiation generate a group key based on the system parameters and the shared secret value.

4. The method for establishing according to claim 1, characterized in that, Step S300 includes: Each node obtains the first message based on the difference between the temporary keys of two adjacent nodes; Each node obtains the second message based on the system parameters and the first message; The broadcast ciphertext includes the first message and the second message.

5. The method for establishing according to claim 4, characterized in that, Step S400 includes: Step 401: Each node verifies the second message of all nodes according to the system parameters. If the verification of the second message of any node fails, the execution is terminated; otherwise, step 402 is executed. Step 402: Each node sums the first messages from all nodes. If the sum is equal to 0, the verification is successful; otherwise, execution is terminated.

6. The method for establishing according to claim 5, characterized in that, The system parameters include a symmetric encryption / decryption algorithm, a first hash function, a second hash function, a hash key, and an initial state value. The trusted center performs the following operations to select the system parameters: Choose a symmetric encryption algorithm: And the corresponding symmetric decryption algorithm: Where {0,1} * A bit string of 0s and 1s of arbitrary length. This represents the value space of the symmetric encryption key; Choose the first hash function Choose the second hash function Where l is the output bit length of the second hash function. The value space of the key for the second hash function; from Then select the hash key K for the group and distribute the hash key K to each node in the group; from Then select the initial state value S0 of the group and distribute the initial state value S0 to each node in the group.

7. The method for establishing according to claim 6, characterized in that, The second message obtained by each node based on the system parameters and the first message includes: Node i calculates the second message h according to the following formula. i : h i =H2(K,ID i ||x i ) Among them, ID i This represents the identity information of node i, where || represents the connector, and x i Let i be the first message of node i, where i∈{0,…,n-1} and n is the number of nodes.

8. The method for establishing according to claim 7, characterized in that, Each node verifies the second message of all nodes according to the system parameters, including: Node i verifies whether the following equation is true: h j =H2(K,ID j ||x j ) Among them, h j The second message for node j, ID j For the identity information of node j, x j Let be the first message of node j, where j∈{0,…,n-1}, n is the number of nodes and j≠i.

9. The method for establishing according to claim 7, characterized in that, Step S500 includes: Node i calculates the shared secret value gsk according to the following formula. i : gsk i =(n-1)x i +(n-2)x i-1 +…+x i-n+2 -n(r i +r i+1 ) Where, x i x i-1 ... x i-n+2 For the first message of the corresponding sequence number node, r i and r i+1 Let be the temporary keys for the i-th node and the (i+1)-th node.

10. The method for establishing according to claim 9, characterized in that, Each node generates a group key based on the system parameters and the broadcast ciphertext of all other nodes, including: Node i calculates the group key wk according to the following formula. i : wk i =H1(gsk i ,S0,ID0,x0,ID1,x1,…,ID n-1 ,x n-1 )。

Images